Wiz Cloud Fundamentals

Correct answer: C. WizCloudCostPolicy.

The optional WizCloudCostPolicy is attached to the Wiz IAM role to fetch cost data for cloud cost visibility. The other options handle runtime protection or EKS scanning, but they do not provide the specific permissions required for cost retrieval.

Correct answer: D. Creating an Automation Rule.

Automation Rules link triggers like issue creation to actions such as sending tickets to Jira. Action templates only define the payload, but the automation rule itself is required to execute the workflow automatically.

Correct answer: B. Centralizing Connector management via a single Stack in the Management Account.

Converting to an Organization deployment centralizes management into a single Management Account CloudFormation stack. You still need local roles in child accounts for scanning, so eliminating IAM entirely is a distractor.

Correct answer: B. Monitored Metrics

Monitored metrics track custom framework performance over time to assess compliance and gamification success. The security graph maps relationships, but it does not provide the longitudinal reporting needed for scorecards.

Correct answer: B. Virtual machine disk files, public and private buckets, and PaaS/IaaS databases.

The default scanning scope targets cloud infrastructure including virtual machine disks, buckets, and platform databases. It does not scan external SaaS applications or on-premises file servers, which require separate connectors.

Correct answer: B. The Issue is due, will be due in X days, or is overdue by X days (Due trigger).

The due trigger fires an automation rule when an issue is due, upcoming, or overdue, allowing teams to manage risk timelines. Severity and status changes are valid triggers, but they do not evaluate mitigation timeliness.

Correct answer: C. Every 5 minutes.

Version 2.5.9 and later fetch admission policies from the backend every five minutes to maintain enforcement. This polling interval replaced older static deployment models to ensure Kubernetes clusters receive prompt updates.

Correct answer: C. Wiz Terraform Provider

The Wiz Terraform Provider is the recommended tool for bulk user creation and management. While the CLI handles local scans and data sources query existing infrastructure, only the provider actively manages user configurations.

Correct answer: C. They are ingested as Cloud Events and viewable on the Cloud Events Explorer page.

Wiz imports Admission Reviews as Cloud Events, allowing users to analyze them using the dedicated Cloud Events Explorer. Do not confuse these with standard configuration issues; they are processed as runtime events to trigger detections and automations.

Correct answer: C. Wiz Broker

The Wiz Broker functions as a reverse proxy, tunneling communication between the Wiz backend and resources located in private or on-premises networks. A practical cue is to associate the Broker with bridging isolated networks to the SaaS platform.

Correct answer: B. The vulnerability is removed from the Wiz portal 7 days after it is resolved.

Vulnerability findings are retained in the portal for seven days after resolution before automatic removal. This retention window ensures security teams have sufficient time to verify remediation and audit historical issue data.

Correct answer: B. Wiz stores only security metadata and findings, avoiding storage of customer data, files, or intact secrets.

Wiz stores only security metadata and findings, ensuring that copies of customer data, files, or intact secrets are not kept in the backend. This privacy-by-design approach means Wiz never stores actual disk images or databases.

Correct answer: D. The Graph database (Security Graph).

The Security Graph is central to storing all resource data and relationships, allowing analytical modules to enrich entities and identify attack paths. Other analyzers feed data into the graph, but the graph itself maps the correlations.

Correct answer: C. Provisioning the EKS cluster and all other required resources within the dedicated Outpost account.

The Wiz Orchestrator Role provisions and manages the dedicated infrastructure, including the EKS cluster, within the Outpost account. For the exam, remember that Outpost relies on this role for initial resource creation rather than read-only metadata fetching or direct runtime threat detection.

Correct answer: C. Vulnerability Management & Response tools integration.

Integrations with Vulnerability Management and Response tools pull Wiz findings to help prioritize risks by adding attack path context. Do not confuse this with data lineage, which tracks data flows rather than infrastructure vulnerabilities and their exploitation paths.

Correct answer: B. It avoids impacting the performance or operation of the live workload during scanning.

Wiz avoids impacting live workload performance by scanning out-of-band disk snapshots. The strongest distractor suggests forensic capabilities, but remember that the primary benefit of agentless scanning is operational safety rather than deep disk forensics.

Correct answer: B. Only the collected security metadata, such as findings, installed packages, vulnerabilities, and secrets hashes/snippets.

A strict data barrier ensures only security metadata, such as vulnerability findings and package lists, returns to the Wiz backend. It is crucial to remember that full disk snapshots and raw runtime logs never leave the local environment.

Correct answer: C. When there is a known and accepted risk that currently lacks an available fix.

Ignoring a finding is appropriate when there is a known and accepted risk that currently lacks an available fix. Remember that severity levels or age do not justify ignoring issues unless the risk has been explicitly accepted as a temporary exception.

Correct answer: C. A cloud configuration finding is generated and associated with the resource on the security graph.

Failing a Cloud Configuration Rule generates a configuration finding attached to that specific resource within the security graph. This foundational concept is critical because findings feed into controls, which subsequently generate prioritized issues.

Correct answer: C. Policies generate Findings, which are processed by Controls to identify toxic combinations that manifest as Issues.

Policies generate individual findings, which controls then analyze to identify dangerous combinations known as issues. Memorize this exact flow, as understanding how the security graph correlates discrete risks into issues is essential.

Correct answer: D. Wiz Runtime Sensor.

The Wiz Runtime Sensor is an eBPF-powered executable that delivers real-time visibility into cloud workloads. Use this specific detail to separate it from the admission controller, which handles Kubernetes deployment policies.

Correct answer: B. On your existing Wiz tenant.

The remote Model Context Protocol server runs directly on your existing Wiz tenant. Do not confuse the remote server with older or local implementations, which require separate infrastructure and are no longer actively maintained.

Correct answer: C. Agentless scanning of a snapshot or disk created from the running workload.

Wiz performs malware analysis using agentless scanning of a snapshot or disk clone, avoiding any impact on the live workload. For the exam, always associate malware detection with offline snapshot analysis rather than agents or network tapping.

Correct answer: C. A sample of related Findings and a mini-graph showing which objects were deleted or changed.

Issue resolution evidence includes a sample of related findings and a mini-graph detailing which objects were modified or deleted, which is retained for 180 days. Be careful not to confuse this with full attack path JSONs, as Wiz only retains a specific snapshot for compliance tracking.

Correct answer: C. Wiz Admission Controller (Wiz AC).

The Wiz Admission Controller enforces policies defined using Cloud Configuration Rules to audit or block resource creation in Kubernetes clusters. Do not confuse this with the Wiz Broker, which acts as an integration gateway rather than an in-cluster enforcement tool.

Correct answer: B. Explorer > Cloud Cost

Cloud spending visibility and optimization recommendations are found on the Explorer menu under the Cloud Cost page. Avoid choosing Inventory or Policies, as those focus on asset tracking and rule configuration rather than financial data.

Correct answer: B. It eliminates the need to handle configuration, token management, rate limiting, and pagination manually.

The Python SDK streamlines programmatic interaction by abstracting away complex operational overhead like configuration, authentication token management, rate limiting, and pagination. The SDK handles the API plumbing automatically rather than supporting custom policy languages.

Correct answer: B. Template variables.

Template variables are used within the action configuration to define and customize specific data fields included in the outgoing payload to third-party tools. You are simply formatting a payload rather than writing GraphQL queries or complex scripts.

Correct answer: C. wiz_remediation_and_response_deployment_v2

The wiz_remediation_and_response_deployment_v2 resource is used to programmatically manage the customer-side infrastructure components needed for Remediation & Response. For the exam, remember that Wiz uses Terraform providers specifically to automate secure remediation deployments.

Correct answer: B. Overprivileging and lateral movement.

Analyzing effective permissions helps identify and remediate risks associated with overprivileging and potential lateral movement paths. Cloud identity and entitlement management focuses on access control, not malware prevention or denial of service mitigation.

Correct answer: A. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, and roles/iam.securityAdmin.

Deploying at the GCP organization level requires specific administrative roles for service accounts, organization roles, and security. Simple viewer roles lack the necessary permissions to establish the required service accounts and ingest security data.

Correct answer: B. Load balancers or internet gateways.

The Network Analyzer models external connection points like load balancers and internet gateways as direct links to the internet. When studying exposure paths, focus on infrastructure routing components rather than identities or vulnerability findings.

Correct answer: C. National Vulnerability Database (NVD)

The National Vulnerability Database is one of the public sources Wiz uses to ingest vulnerability data alongside cloud service provider feeds. Watch for valid vulnerability databases versus unrelated enumeration frameworks.

Correct answer: B. Automated Platform Actions

Automated Platform Actions allow users to directly modify internal Wiz objects, like Issues and Threats, without external integrations. Remember that manual actions typically involve triggering external webhooks or ticketing systems like Jira.

Correct answer: C. Network Analyzer

The Dynamic Scanner depends on the Network Analyzer to properly calculate exposure paths and validate external attack surfaces. Avoid choosing the broker or CLI, because those components handle data transmission or command-line queries instead.

Correct answer: C. admin:all and create:service_accounts.

Permissions like admin:all and create:service_accounts are highly sensitive due to the severe risk of privilege escalation. For the exam, always categorize broad administrative rights as exceptions to standard custom role assignments.

Correct answer: C. Vulnerabilities in the Linux kernel.

Wiz specifically checks the Linux kernel for vulnerabilities to mitigate risks in critical operating system components. You should easily eliminate the Windows KB option here since the question explicitly targets Linux environments.

Correct answer: B. Settings > Compliance Frameworks

Built-in host configuration assessment frameworks are enabled and managed under Settings, then Compliance Frameworks, so the administrator can benchmark operating systems and applications. For the exam, remember that Inventory is for exploration, while Settings governs frameworks and rules.

Correct answer: C. Boards (Dashboards).

Boards provide customizable dashboards that summarize security metrics and compliance health for executives. While the inventory page details raw resource data, boards aggregate this information into role-specific, high-level visuals needed for strategic decision-making.

Correct answer: C. Configuring firewall and port configurations in the Customer-owned cloud environment.

In the Wiz-managed Outpost model, the customer controls firewall and port configurations within their own cloud environment. Wiz handles securing the backend systems and encrypting data in transit between the Outpost and connectors.

Correct answer: C. The Resource Discovery Scripts documentation pages.

Resource discovery scripts are documentation tools that estimate billable usage metrics before full scanning begins. Remember that accurate counts appear on the Licenses page only after the connector successfully integrates with the environment.

Correct answer: A. YARA Rules written and maintained by the Wiz Research Team.

The proprietary Malware Analyzer uses YARA rules written and maintained by the Wiz Research Team to detect generative malware. While it leverages ReversingLabs for hash-based detection, the YARA engine specifically targets novel or generated threats.

Correct answer: C. Scytale (Compliance Management)

Scytale is a compliance management platform that pulls Wiz issues and resources to generate evidence for compliance controls like SOC 2 and ISO 27001. Do not confuse this with DefectDojo, which focuses strictly on vulnerability management rather than audit evidence.

Correct answer: B. Software Composition Analysis (SCA) functionality

Software Composition Analysis functionality analyzes both direct and transient code library dependencies to detect vulnerabilities in open source libraries. Expect to map dependency analysis and SCA together, distinguishing it from dynamic scanning or network analysis.